Arbitrary Code Execution Vulnerability in Bentley MicroStation CONNECT

CVE-2022-28306

Summary

This vulnerability exposes installations of Bentley MicroStation CONNECT to arbitrary code execution, enabling remote attackers to take control of the process. The exploit requires user interaction, as the target must open a malicious OBJ file. The flaw results from inadequate validation of user-supplied data length when parsing OBJ files, leading to potential buffer overflow conditions. An attacker can leverage this weakness to execute arbitrary code with the privileges of the current process, posing a significant risk to affected systems.

References